In that case, it occurs to me that one could hash a shorter string (like, say 128 bits) and use it. And if the seed is 128 bits, it can be encoded as 12 words of BIP-39.

I mean, one could use BIP-39 anyway, 24 word variant. Just spitballing.